CVE-2020-16881: 
Visual Studio Code vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-16881) exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. The vulnerability was disclosed in September 2020 and affects Visual Studio Code versions up to (excluding) 1.48.1 (NVD).

The vulnerability allows attackers to execute arbitrary code in the context of the current user through a specially crafted 'package.json' file. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, an attacker could run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take complete control of the affected system, including installing programs, viewing or modifying data, and creating new accounts with full user rights (NVD).

To exploit this vulnerability, an attacker needs to convince a target to clone a repository and open it in Visual Studio Code. The attacker-specified code executes when the target opens the malicious 'package.json' file. Security researcher Justin Steven reported that Microsoft's initial fix for this vulnerability could be trivially bypassed (SecurityWeek).

Microsoft addressed the vulnerability by modifying the way Visual Studio Code handles JSON files. Users should update to Visual Studio Code version 1.48.1 or later to receive the security fix (NVD).

The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to encourage users and administrators to install the available patches. The vulnerability received attention when security researcher Justin Steven revealed on Twitter that Microsoft's initial patch could be bypassed (SecurityWeek).